The Fine Print

Some business aviation operators, like airlines and private pilots, are highly motivated to introduce or update installed or portable electronic flight bags (EFBs) in their flight decks. If they proceed, their large multi-engine, turbine-powered aircraft or other applicable regulatory factors may dictate they must comply with comprehensive airline-level requirements — with the built-in benefit of the latest expertise of aviation safety and human factors specialists. Others have latitude to use EFBs under self-­compliance guidelines and to voluntarily adopt best practices in risk mitigation through hardware/software choices, policies, procedures, training and other considerations.

Those with latitude may benefit from a working familiarity with the airline-level requirements, and resources such as publicly available, pilot-generated safety reports. In the evolution of this technology, users first welcomed EFBs as a way to reduce or eliminate the need for paper aeronautical charts, diagrams and other reference materials. At airlines, EFB aircraft performance computers have been used for decades. Currently, business aircraft operators also can contemplate adding advanced functions, features such as own-ship display and hosted applications as these become approved/approvable by civil aviation authorities (ASW, 5/12, p.19).

Operators in the United States can find safety-relevant explanatory background in the Federal Aviation Administration’s (FAA’s) Advisory Circular (AC) 120-76B, “Guidelines for the Certification, Airworthiness, and Operational Use of Electronic Flight Bags,” which took effect June 1, 2012. News about the final AC often focused on standards and requirements for using acceptable devices and software. However, business aircraft operators also can consult this AC to gauge what the FAA considers optimal safety choices.

Known Risk Factors

In 2010, researchers at the U.S. Department of Transportation (DOT) reported on subject matter experts’ analysis of observed outcomes and anomalies in EFB-related voluntary safety reports from pilots.1 They selected and studied 67 pilot reports collected in August 2009 from the Aviation Safety Reporting System (ASRS) database maintained by the U.S. National Aeronautics and Space Administration. Although EFB-related errors and problems were reported by all types of pilots, the researchers differentiated anomalies among pilots operating under general aviation regulations and those of airline flight crews operating under Federal Aviation Regulations (FARs) Part 121, noting, “Part 91 operators are not required to follow this guidance, and it is therefore possible that they receive less training on EFBs than the Part 121 flight crews.”

Essentially, they broke down safety-relevant findings into those involving procedures for interaction between pilots while using EFBs, such as when sharing or cross-checking information; situations requiring pilots to alter how information is presented, such as zooming or panning displays without missing critical data temporarily hidden off-screen; inadequate training of crewmembers who initially were entirely unfamiliar with the EFB; failing to resolve difficulties that pilots reported about using the EFB, including data entry, legibility of display elements, suspected software malfunctions or selecting required navigation charts while needing to access more than one display of information under abnormal conditions; preventing and responding to an outdated EFB database; preflight or in-flight recovery/backup in case of an inoperative EFB; confusion about interpreting information “due to inconsistencies between expected and actual format”; and reliably powering the EFB to prevent interruptions.

Among the most serious situations in the report were the pilot monitoring becoming “preoccupied” with the EFB during taxi, as the pilot flying missed a taxi clearance restriction or hold short line, and “company policy deviations, expired databases, incorrect computations, altitude confusion, an aborted takeoff and a tail strike upon rotation.” They characterized the significant risk areas for operators as heading/altitude/speed deviation, runway incursion, noncompliance with company policy, expired database, incorrect weight and balance for takeoff (including tail strike), erroneous airplane performance data unrecognized when it caused no adverse effects, altitude deviation during a declared emergency, rejected takeoff, confusion about altitude, near-deviation from assigned altitude, and “taxi-route confusion without an airport diagram.”

DOT has not repeated this analysis for post-2010 safety reports involving EFB chart applications (apps); its data query had covered 1995 to 2009. Business aviation operators’ interest, however, has expanded now to include observed anomalies and risks involved in transitioning to the capabilities and interfaces of consumer tablet-based EFBs — such as the Apple iPad2 and its iOS operating system interface (ASW, 10/12, p. 43). The 2010 analysis nevertheless provides context and points of comparison, for example, of business aviation pilots’ post-2010 safety reports to ASRS involving EFBs (see “Safety Reports From Pilots Using Tablet EFBs in Business Aviation”).

Safety Reports From Pilots Using Tablet EFBs in Business Aviation

In the years after publication of results from a U.S. Department of Transportation analysis1 of 67 safety reports from pilots about their regulatory violations and other anomalies involving electronic flight bags (EFBs), more than 100 such reports have been added to the Aviation Safety Reporting System (ASRS) online database administered by the U.S. National Aeronautics and Space Administration.2

The following excerpts from 2012 ASRS reports, selected by ASW, reflect comparable pilot experiences specifically involving business aviation and tablet EFBs — including relatively recent use of EFB apps on the Apple iPad and its iOS operating system.

A flight crew operating a corporate Cessna Citation C650 prepared to depart from Teterboro (New Jersey, U.S.) Airport on the assigned route of TEB RUUDY FOUR LANNA J48. The second-in-command pilot monitoring later explained how they had used the ForeFlight [Mobile] app on an iPad. “For a backup and great situational awareness in case the FMS [flight management system] malfunctions during the initial climb, I manually entered the RUUDY FOUR [departure procedure] waypoints. …. With an external GPS [global positioning system receiver connected to the iPad], I am able to view the aircraft’s position in real time on a map. … After entering the flight plan into our FMS, I expressed concern that we were unable to view the RUUDY FOUR departure procedure waypoints in the FMS even though we had selected the RUUDY FOUR departure procedure when the unit prompted us. After departure, the captain began to execute the RUUDY FOUR departure procedure. Upon reaching TASCA and climbing through about 3,000 MSL [mean sea level], I noticed on the FMS the current waypoints in progress [indication] was RUNWAY 24 LANNA. This was not correct; the FMS had dropped the departure procedure and had the flight director tracking a course from the runway to LANNA [intersection,] which was further southwest on our route. Meanwhile, I [was] watching our aircraft’s position parallel and drift further south and southeast of our required course on my iPad. I encouraged the captain to fly heading 280 for a longer period of time to prevent drifting and reach RUUDY before turning southwest to LANNA, but he was confused and continued to fly about a 240-degree heading towards LANNA. … New York Center [asked us] to state our heading and if we were flying the RUUDY FOUR [departure]. ATC [air traffic control] then issued us a heading of 280 to fly and began questioning what procedure we were flying and [told me] when I have time, to study the RUUDY FOUR [procedure].” (ASRS no. 991216, January 2012)

A fractional operator’s flight crew departed in a Cessna Citation X from San Francisco International Airport flying the OFFSH5 departure. ATC observed the aircraft make an incorrect turn and intervened by issuing vectors to rejoin the charted course. The captain, the pilot monitoring, later said, “Because the course needed to be defined with a VOR [very high frequency omnidirectional range station] that was not depicted on the FMS [flight management system] flight plan page (PYE VOR), I opted to step down the automation and type PYE into my green needles and join the appropriate radial. I was not aware I must have hit the chart number at the bottom of the iPad with my hand or arm, and switched from the OFFSH5 to the PORTE3 departure [and then intercepted the PYE VOR 135 radial instead of the correct 151 radial]. In short, I was now looking at the Porte 3 departure, which is a very similar visual depiction. … I noticed our mistake within a couple of minutes, but by the time we were correcting, we were given direct to another fix. I noticed the wrong departure on the iPad. We must be very aware that the iPad can change pages without the pilot knowing.” (ASRS no. 1022749, July 2012)

The flight crew of a corporate Raytheon Super King Air 200 preparing to depart from Phoenix Sky Harbor International Airport was cleared by ATC for the Stanfield 3 departure with OLIIN transition J2 ALIBY. The pilot monitoring later said, “I was talking to clearance [delivery] and referencing an iPad with freshly downloaded government charts: Hi, Low and approach plates. I was not able to find OLIIN [intersection] on either Hi or Low IFR [instrument flight rules] en route charts, so I asked clearance for a clarification on how to transition from OLIIN to J2. OLIIN was shown on the Stanfield 3 departure but not shown on J2.” ATC amended the clearance to omit these fixes, and the aircraft departed uneventfully. During cruise, however, the crew noticed that — unlike the charts on their first iPad consulted — their second iPad with the same government data downloaded from a different source did depict OLIIN intersection. (ASRS no. 1036925, September 2012)

During arrival for the Runway 6 ILS approach to Teterboro (New Jersey, U.S.) Airport, the flight crew of a corporate medium-transport turbojet received a TCAS [traffic-alert and collision avoidance system] “TRAFFIC” alert just prior to DANDY intersection. “I looked to my right and saw an aircraft climbing out of [Newark Liberty International Airport],” the reporting pilot said. “TCAS showed he was about 1,000 ft above our altitude and was not a factor. My attention went back to the PFD [primary flight display on] which I noticed we would be crossing DANDY on the glideslope. At that point, I remembered from previous trips to Teterboro the mandatory 1,500 ft [crossing altitude restriction] at DANDY. We had not briefed this crossing in our approach briefing. I believe this occurred because of a lack of proficiency using the EFB in the aircraft. I have been using my iPad for commercial charts on the other aircraft I fly. I chose to use the EFB installed in this aircraft so as not to add more distractions in the cockpit. The EFB was left in the segmented view by the previous crewmember, and I failed to change the view. In this case, the profile segment was set to the briefing strip and not the profile view of the approach plate. Not seeing the profile view, I failed to notice the mandatory crossing at DANDY intersection.” (ASRS no. 1043846, October 2012)

The flight crew of a corporate Cessna Citation C560 was using the flight management system (FMS) to conduct the JHAWK6 standard terminal arrival route into Charles B. Wheeler Downtown Airport (Kansas City, Missouri, U.S.) when the approach controller observed a noncompliant turn toward Kansas City International Airport and instructed them to turn to heading 010. The captain later recalled, “I had the arrival [chart] displayed on my iPad, and the other pilot had the ILS displayed on his iPad. As we approached the NOAHS intersection, my iPad battery went dead. By the time the other pilot switched his iPad to the arrival [chart], our FMS started turning [the airplane] to the airport rather than [the crew] switching to heading mode and flying a heading of 010. [The controller] noticed the turn in progress and gave a correctional turn, and the flight continued with vectors to a visual approach. … The time of battery life is not good on long trips, so we will charge up the battery on our iPads en route.” The first officer flying added, “We now have chargers in the cockpit to ensure battery performance of both iPads.” (ASRS no. 1043606, October 2012)

Reports in this publicly accessible database are a small vetted fraction of all reports received, selected based on expert opinion of the potential value of reporters’ narratives for safety education in the aviation community. ASRS website guidance states limitations of this database, such as its unsuitability for statistical analysis, counting occurrences or calculating rates (ASW, 3/12, p. 43).

Insights From AC 120-76B

Used with other official documents that it references for EFB technical standards, selection, testing, installation and any required approvals, this AC provides comprehensive, practical recommendations to reduce the known risks. It addresses how to follow the guidance from the manufacturer, FAA and operator, as well as establishing pilot training, checking and currency requirements for specific aircraft implementations and for normal/non-normal operational scenarios, in which human factors can be as important as EFB integrity and reliability.

AC 120-76B reminds the pilot community, “The intention of this AC is not to supersede existing operational guidance material. Do not use this AC by itself to add own-ship position on Class 1 and Class 2 EFBs. … Class 1 or Class 2 EFBs must not display own-ship position while in flight. … For guidance on the display of own-ship position, refer to Technical Standard Order (TSO)-C165, ‘Electronic Map Display Equipment for Graphical Depiction of Aircraft Position.’ … All information contained in the EFB intended for operational use must be current and up-to-date.”

The AC cautions about own-ship position because of technical standards and the need to address human factors with approved pilot training for its safe use. Otherwise, operators/users familiar with FAA-approved EFBs that do include own-ship position on aircraft moving map displays — which may be hosted on portable EFBs per associated standards and approvals — might assume that for operational use, safety involves little more than connecting, for example, a consumer tablet with EFB apps to peripheral devices such as portable global positioning system (GPS) receivers and automatic dependent surveillance–broadcast (ADS-B) receivers.

Technically, parts of the AC’s content do not apply to some business aviation operations, but principles involved are valuable to know. For example, details of the user/operator operational test evaluation for FARs Part 121/135–certificated operations and Part 91K [fractional] operators may inspire voluntary equivalent actions. Other principles can be deduced from the AC’s provision that “operators must determine the usage of hardware and/or software architectural features, people, procedures, and/or equipment to eliminate, reduce, or control risks associated with an identified failure in a system.”

Before using a specific EFB, a certificated operator also must document things like training effectiveness, operational effectiveness and reliability of the EFB. This includes modifying policies and procedures affected by introducing EFBs into line operations, such as those for normal, abnormal and emergency use in all flight conditions. “Flight crew procedures will ensure that the flight crew knows what aircraft system to use for a given purpose, especially when both the aircraft and EFB are providing similar information,” the AC says. “Procedures should also be designed to define the actions to be taken when information provided by an EFB does not agree with that from other flight deck sources or when one EFB disagrees with another.”

Such guidance accounts for lessons learned from scientific research, expert opinion and pilot experiences such as those in the ASRS reports. “It is necessary [for operators] to evaluate the human factors/pilot interface characteristics of the EFB system,” the AC says. “Special attention should be paid to new or unique features that may affect pilot performance.”

In another example, pilots appreciate how well EFBs legibly display one-page instrument approach charts under all flight deck lighting conditions. “This requirement is not meant to preclude panning and zooming features, but is intended to prevent a workload increase during the approach phase of flight,” the AC notes, adding that “a moving map centering feature (not own-ship position depiction or aircraft symbol) may be desirable [for certain aerodrome charts]. …. Any active manipulation (e.g., zooming, panning, or decluttering) should be easily returned to the default position. … If the document segment is not visible in its entirety in the available display area, such as during ‘zoom’ or ‘pan’ operations, the existence of off-screen content should be clearly indicated in a consistent way.”

EASA’s EFB Cautions

Like FAA AC 120-76B, the European Aviation Safety Agency’s (EASA’s) October 2012 report3 on its assessment of two versions of an iPad EFB app contains technically specific approvals plus observations potentially relevant to other EFB apps. In harmony with FAA policy, EASA’s report notes that, “Activating the own-ship position option may define an application as … requiring an EASA airworthiness approval.” Moreover, EASA pointed out how this app generates a crew-alert message if own-ship position inadvertently becomes enabled, and therefore advised operators to ensure pilots learn of this alert’s significance in their training and manuals.

The report also contained observations such as, “An operator’s EFB administrator should ensure that non-EFB software applications do not adversely impact the operation of the EFB. … Non-Jeppesen applications providing an indication of current position (e.g., Apple’s ‘Maps’ application) should be considered to be non-approved [airworthiness approval–required] applications if the present position function is not inhibited and locked by the administrator. … There is no way to ensure at the applications level that [interactions] (visual and auditory) coming from non-EFB applications are disabled. Pop-ups, notifications and alarm sounds may be triggered unexpectedly depending on the configuration.”

EASA’s general recommendations to operators include performing formal operational risk analysis of EFBs, line-oriented flight training in a simulator that includes items such as a late runway change and diversion to an alternate airport, and observation by a civil aviation authority inspector of initial line flights on which the flight crew uses EFBs.